filenameTESV.exe
size19033088 (0x1226c00)
md5cbd94552358356628c858b5db8f0f5e4
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x130

DOS stub

00000000: 56 4c 56 00 01 00 00 00  00 2c 28 01 24 aa ef 4e  |VLV......,(.$..N|
00000010: 1b 89 79 24 bf ea fa 34  73 6b 1c 3a ac 89 f9 e3  |..y$...4sk.:....|
00000020: ce e4 bd 94 7a 5c 2e 64  85 01 70 ba 1f e9 9d b6  |....z\.d..p.....|
00000030: 8d f0 d6 a6 2c bf 14 02  cd 2f f5 66 42 54 ee 3f  |....,..../.fBT.?|
00000040: 2b ef 04 53 20 ce 24 44  3d d9 b2 78 d6 bb d5 ef  |+..S .$D=..x....|
00000050: c2 40 3e 79 a5 68 a2 7c  48 e6 ff 66 66 dc 3c 10  |.@>y.h.|H..ff.<.|
00000060: 8c df 1b f1 a1 89 62 b7  ea 4e 82 d8 d8 3e be f9  |......b..N...>..|
00000070: 9d 8d bf 1e 0a e4 20 4f  3d 92 4e 15 23 b7 16 79  |...... O=.N.#..y|
00000080: f9 8c d9 49 50 9a ef c8  3f 70 ae 54 f1 39 7b 0e  |...IP...?p.T.9{.|
00000090: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000f0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x4ee667a4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion9.0
SizeOfCode0xe0ce00
SizeOfInitializedData0x419a00
SizeOfUninitializedData0
AddressOfEntryPoint0xd1264b
BaseOfCode0x1000
BaseOfData0xe0e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x138f000
SizeOfHeaders0x400
CheckSum0x1285366
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v6.0 (Silicon Realms Toolworks)

Sections

namevavsizeraw sizeflags
.text0x10000xe0cc9f0xe0ce00R-X CODE
.rdata0xe0e0000x1f41980x1f4200R-- IDATA
.data0x10030000x203afc0x9ee00RW- IDATA
.tls0x12070000x26010x2800RW- IDATA
.rsrc0x120a0000xb7be40xb7c00R-- IDATA
.reloc0x12c20000xcc4240xcc600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x10009300x140
RESOURCE0x120a0000xb7be4
EXCEPTION00
SECURITY0x1282c000x1750
BASERELOC0x12c20000xb92b8
DEBUG0xe204700x1c
ARCHITECTURE00
GLOBALPTR00
TLS0xf76ef80x18
LOAD_CONFIG0xf76ea80x40
Bound_IAT00
IAT0xe0e0000x45c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x16070000x16096000x16041b80x122044c00
typenamesizecp
DATA__GDF_XML54821252
BITMAP#18010641252
ICON#1747921252
ICON#1747921252
ICON#237521252
ICON#237521252
ICON#322161252
ICON#322161252
ICON#417361252
ICON#417361252
ICON#513841252
ICON#513841252
ICON#62703761252
ICON#62703761252
ICON#796401252
ICON#796401252
ICON#842641252
ICON#842641252
ICON#924401252
ICON#924401252
ICON#1011281252
ICON#1011281252
GROUP_ICON#1011461252
GROUP_ICON#1011461252
VERSION#17881252
MANIFEST#13461252
module_namehintordfunction_name
KERNEL32.dll81CompareFileTime
KERNEL32.dll285FindFirstFileA
KERNEL32.dll1190lstrcatA
KERNEL32.dll1199lstrcpyA
KERNEL32.dll765LocalFree
KERNEL32.dll327FormatMessageA
KERNEL32.dll486GetLastError
KERNEL32.dll272FileTimeToSystemTime
KERNEL32.dll271FileTimeToLocalFileTime
KERNEL32.dll108CreateDirectoryA
KERNEL32.dll153CreateSemaphoreA
KERNEL32.dll67CloseHandle
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll853QueryPerformanceFrequency
KERNEL32.dll423GetCurrentDirectoryA
KERNEL32.dll180DebugBreak
KERNEL32.dll763LocalFileTimeToFileTime
KERNEL32.dll1066SystemTimeToFileTime
KERNEL32.dll487GetLocalTime
KERNEL32.dll192DeleteFileA
KERNEL32.dll442GetDriveTypeA
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll260ExitProcess
KERNEL32.dll96CopyFileA
KERNEL32.dll701InterlockedExchange
KERNEL32.dll702InterlockedExchangeAdd
KERNEL32.dll544GetProcAddress
KERNEL32.dll753LoadLibraryA
KERNEL32.dll332FreeLibrary
KERNEL32.dll619GetTimeZoneInformation
KERNEL32.dll139CreateMutexA
KERNEL32.dll906ResetEvent
KERNEL32.dll979SetEvent
KERNEL32.dll302FindNextFileA
KERNEL32.dll114CreateEventA
KERNEL32.dll887ReleaseMutex
KERNEL32.dll909ResumeThread
KERNEL32.dll1063SuspendThread
KERNEL32.dll1035SetThreadPriority
KERNEL32.dll428GetCurrentThread
KERNEL32.dll826OutputDebugStringA
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll1020SetStdHandle
KERNEL32.dll490GetLocaleInfoW
KERNEL32.dll576GetStringTypeW
KERNEL32.dll573GetStringTypeA
KERNEL32.dll733IsValidLocale
KERNEL32.dll248EnumSystemLocalesA
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll1076TlsGetValue
KERNEL32.dll1116VirtualQuery
KERNEL32.dll830PeekNamedPipe
KERNEL32.dll464GetFileInformationByHandle
KERNEL32.dll405GetConsoleMode
KERNEL32.dll387GetConsoleCP
KERNEL32.dll991SetFilePointer
KERNEL32.dll281FindClose
KERNEL32.dll1075TlsFree
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll891ReleaseSemaphore
KERNEL32.dll85CompareStringW
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll614GetTickCount
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll1077TlsSetValue
KERNEL32.dll585GetSystemInfo
KERNEL32.dll1074TlsAlloc
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll471GetFileType
KERNEL32.dll1000SetHandleCount
KERNEL32.dll676HeapReAlloc
KERNEL32.dll671HeapCreate
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll338GetACP
KERNEL32.dll1004SetLastError
KERNEL32.dll571GetStdHandle
KERNEL32.dll347GetCPInfo
KERNEL32.dll739LCMapStringW
KERNEL32.dll737LCMapStringA
KERNEL32.dll430GetDateFormatA
KERNEL32.dll629GetVersionExA
KERNEL32.dll725IsProcessorFeaturePresent
KERNEL32.dll715IsBadWritePtr
KERNEL32.dll976SetEnvironmentVariableA
KERNEL32.dll82CompareStringA
KERNEL32.dll616GetTimeFormatA
KERNEL32.dll914RtlUnwind
KERNEL32.dll678HeapSize
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll669HeapAlloc
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll673HeapFree
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll1032SetThreadIdealProcessor
KERNEL32.dll454GetExitCodeThread
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll476GetFullPathNameA
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll373GetComputerNameA
KERNEL32.dll621GetUserDefaultLCID
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll367GetCommandLineA
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll858RaiseException
KERNEL32.dll457GetFileAttributesA
KERNEL32.dll534GetPrivateProfileIntA
KERNEL32.dll1170WritePrivateProfileStringA
KERNEL32.dll540GetPrivateProfileStringA
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll1060SleepEx
KERNEL32.dll995SetFileTime
KERNEL32.dll785MoveFileA
KERNEL32.dll1166WriteFileEx
KERNEL32.dll547GetProcessHeap
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll873ReadFileEx
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll470GetFileTime
KERNEL32.dll469GetFileSizeEx
KERNEL32.dll1111VirtualFree
KERNEL32.dll807OpenEventA
KERNEL32.dll815OpenMutexA
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll458GetFileAttributesExA
KERNEL32.dll437GetDiskFreeSpaceExA
KERNEL32.dll658GlobalMemoryStatusEx
KERNEL32.dll163CreateThread
KERNEL32.dll261ExitThread
KERNEL32.dll1067SystemTimeToTzSpecificLocalTime
KERNEL32.dll120CreateFileA
KERNEL32.dll872ReadFile
KERNEL32.dll1165WriteFile
KERNEL32.dll992SetFilePointerEx
KERNEL32.dll973SetEndOfFile
USER32.dll149DefWindowProcA
USER32.dll504MessageBoxA
USER32.dll249GetActiveWindow
USER32.dll168DispatchMessageA
USER32.dll725TranslateMessage
USER32.dll691ShowCursor
USER32.dll103CreateWindowExA
USER32.dll2AdjustWindowRect
USER32.dll563RegisterClassA
USER32.dll470LoadIconA
USER32.dll634SetForegroundWindow
USER32.dll683SetWindowTextA
USER32.dll539PeekMessageA
USER32.dll281GetCursorPos
USER32.dll264GetClassLongA
USER32.dll256GetAsyncKeyState
USER32.dll367GetSystemMetrics
USER32.dll240FindWindowA
USER32.dll385GetWindowLongA
USER32.dll679SetWindowPos
USER32.dll27CallNextHookEx
USER32.dll216EnumChildWindows
USER32.dll266GetClassNameA
USER32.dll396GetWindowTextA
USER32.dll729UnhookWindowsHookEx
USER32.dll687SetWindowsHookExA
USER32.dll306GetKeyboardLayout
USER32.dll269GetClientRect
USER32.dll305GetKeyState
USER32.dll495MapVirtualKeyA
USER32.dll716ToUnicode
USER32.dll293GetForegroundWindow
USER32.dll384GetWindowInfo
GDI32.dll205DeleteDC
GDI32.dll287ExtEscape
GDI32.dll500GetStockObject
GDI32.dll47CreateDCA
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll602RegOpenKeyExA
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll350GetUserNameA
SHELL32.dll276ShellExecuteA
SHELL32.dll188SHGetFolderPathA
ole32.dll102CoTaskMemAlloc
ole32.dll103CoTaskMemFree
ole32.dll16CoCreateInstance
ole32.dll62CoInitializeEx
ole32.dll107CoUninitialize
ole32.dll61CoInitialize
steam_api.dll5SteamAPI_Init
steam_api.dll11SteamAPI_RunCallbacks
steam_api.dll9SteamAPI_RegisterCallback
steam_api.dll50SteamUserStats
steam_api.dll17SteamAPI_UnregisterCallback
X3DAudio1_7.dllX3DAudioCalculate
X3DAudio1_7.dll1X3DAudioInitialize
d3dx9_42.dll147D3DXGetImageInfoFromFileInMemory
d3dx9_42.dll96D3DXCreateTextureFromFileInMemory
d3dx9_42.dll40D3DXCreateCubeTextureFromFileInMemory
d3dx9_42.dll110D3DXCreateVolumeTextureFromFileInMemory
d3dx9_42.dll13D3DXCompileShader
d3dx9_42.dll146D3DXGetImageInfoFromFileA
d3dx9_42.dll94D3DXCreateTextureFromFileExA
d3dx9_42.dll315D3DXVec3TransformCoord
d3dx9_42.dll199D3DXMatrixMultiplyTranspose
d3dx9_42.dll317D3DXVec3TransformNormal
d3dx9_42.dll310D3DXVec3Normalize
d3dx9_42.dll183D3DXLoadSurfaceFromSurface
d3dx9_42.dll198D3DXMatrixMultiply
d3dx9_42.dll195D3DXMatrixInverse
d3dx9_42.dll222D3DXMatrixTranspose
d3dx9_42.dll228D3DXPlaneNormalize
d3dx9_42.dll229D3DXPlaneTransform
d3dx9_42.dll180D3DXLoadSurfaceFromMemory
WSOCK32.dll9
WSOCK32.dll111
WSOCK32.dll16
WSOCK32.dll19
WSOCK32.dll4
WSOCK32.dll10
WSOCK32.dll101
WSOCK32.dll18
WSOCK32.dll12
WSOCK32.dll23
WSOCK32.dll21
WSOCK32.dll11
WSOCK32.dll15
WSOCK32.dll1
WSOCK32.dll151
WSOCK32.dll57
WSOCK32.dll13
WSOCK32.dll2
WSOCK32.dll115
WSOCK32.dll3
WSOCK32.dll52
DINPUT8.dllDirectInput8Create
WINMM.dll148timeGetTime
binkw32.dll20_BinkCopyToBufferRect@44
binkw32.dll74_BinkWait@4
binkw32.dll66_BinkSetSoundSystem@8
binkw32.dll46_BinkOpenDirectSound@4
binkw32.dll52_BinkPause@8
binkw32.dll44_BinkNextFrame@4
binkw32.dll15_BinkClose@4
binkw32.dll45_BinkOpen@8
binkw32.dll24_BinkDoFrame@4
d3d9.dll5D3DPERF_SetOptions
XINPUT1_3.dll4
XINPUT1_3.dll2
XINPUT1_3.dll3

StringTable 040904b0

CompanyNameBethesda Softworks
FileDescriptionSkyrim
FileVersion1.3.10.0
InternalNameSkyrim
LegalCopyrightCopyright 2009 ZeniMax Media Incorporated. All Rights Reserved.
OriginalFilenameTESV.exe
ProductNameTESV: Skyrim
ProductVersion1.3.10.0

VS_FIXEDFILEINFO

FileVersion1.3.10.0
ProductVersion1.3.10.0
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d019027504BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x12041b8